A 16-Year-Old Ran a Global Ransomware Gang

German authorities have identified a 16-year-old Romanian national as the alleged ringleader of KillSec, a ransomware operation linked to roughly 500 confirmed attacks worldwide, according to Dark Reading. At least 70 of those targets were government organisations.

The takedown, dubbed "Operation KillSwitch," involved law enforcement from Germany, the United States, the United Kingdom, Spain, Romania, and Greece, coordinated by Europol and Eurojust. Authorities raided eight properties across four countries and arrested three individuals. Investigators seized five servers and 110TB of stolen data. KillSec's leak site was taken over and redirected to a law enforcement notice.

The alleged ringleader was arrested in Alicante, Spain. A second suspect, Dutch national Fouad Eltibrizi, was arrested in the UK on September 30 and faces US extradition charges related to unauthorised computer access conspiracy, carrying a maximum sentence of ten years.

KillSec operated by exploiting known software vulnerabilities and poorly secured cloud access points to break into enterprise systems, then threatening to publish stolen files unless victims paid a ransom. Investigators also found evidence the group used AI to map potential victims and build its infrastructure.

What you should do: KillSec targeted organisations with known, unpatched vulnerabilities and weak access controls. Check that publicly exposed services require multi-factor authentication and that software is kept current.

Security firm Huntress has identified a campaign where attackers built malicious Custom GPTs — customised ChatGPT instances that anyone can create for specific purposes — and used OpenAI's own domain to deliver malware, according to Dark Reading.

Victims reach the fake bot through the legitimate ChatGPT website, so the URL looks trustworthy. When a user types any prompt, the bot claims the service is unavailable and redirects them to a fake page with a ClickFix prompt — a social engineering (manipulation) technique that tricks users into copying and pasting a system command to "fix" a problem that does not exist. Executing that command installs a RAT (remote access trojan — malware that gives attackers persistent, hidden control of a device). Huntress has responded to at least 40 incidents tied to this campaign.

If you use Custom GPTs, be suspicious of any bot that redirects you elsewhere or asks you to run commands. Legitimate services never ask you to paste code into your own terminal to fix an access issue.

Note: The CVE ID CVE-2026-104286 is the official designation confirmed by both CISA and Fortinet's advisory. The 2026 prefix is unusual for an October 2025 publication — verify against the official advisory before acting.

What FortiMail is: Fortinet's enterprise email security gateway, used by organisations to filter and manage inbound and outbound email.

What it is: A critical zero-day (a flaw being actively exploited before a patch exists) combining path traversal (a technique that tricks a server into accessing files outside its intended directory) and improper handling of null characters, allowing attackers to write arbitrary files to the underlying system.

Who's at risk: Organisations running FortiMail versions 7.2.0 through 8.0.1 with the management interface or IBE feature accessible from the web.

CVSS: 9.8 — Critical. No patch is available yet. Act today.

Root cause: The software fails to properly validate file path inputs and sanitise null byte characters in HTTP and HTTPS requests, allowing a crafted request to escape the intended file directory entirely.

Attack vector: An attacker sends a specially crafted HTTP or HTTPS request to the FortiMail management interface. The server mishandles the path, allowing the attacker to write a file — such as a web shell — to an arbitrary location, potentially achieving full remote code execution (the ability to run any command on the target machine).

Recommended actions:

1. Disable IBE feature support in FortiMail immediately, as Fortinet advises.
2. Block public access to the FortiMail management interface; restrict it to trusted IP addresses only.
3. Review Fortinet's published indicators of compromise (IoCs — specific technical signatures of an attack) to check whether exploitation has already occurred in your environment.

CISA has added this CVE to its Known Exploited Vulnerabilities catalogue and is requiring federal agencies to act within three days. Patches are expected in versions 7.4.9, 7.6.7, and 8.0.2, with no release date confirmed.

For Cybersecurity Awareness Month, Cisco Talos researchers published a practical guide to frustrating attackers before they reach their goals, and it is worth reading for anyone responsible for a network, according to Talos Intelligence.

Two ideas stand out for non-enterprise readers. First, restrict which accounts can log into your most sensitive systems and set alerts for any unauthorised attempts — most attackers rely on tools that work against default configurations, and small deviations can stop them cold.

Second, consider honeypot accounts: decoy email addresses with no real users. Any message sent to them is almost certainly malicious, giving you early warning before a real attack lands. No special software required — just a mailbox nobody legitimate would ever contact.

OpenAI, Google, Meta, Nvidia, xAI, and Anthropic have signed the White House Accord on Super Intelligence, committing to internal AI safety controls, independent audits, and board-level oversight of frontier AI development, according to Dark Reading.

The agreement is entirely voluntary with no binding deadlines. Security experts broadly welcomed it as a starting point while noting that self-regulation without mandatory enforcement has a mixed track record. For everyday users, it signals that even the companies building these systems acknowledge the risks are real.